To configure the SMTP settings, perform the following subtasks:
Specify the SMTP server.
Set the default SMTP notification settings.
(Optional) Set authentication for SMTP notification settings.
(Optional) Set preferences for SMTP notifications.
Go to CLI configuration mode:
hostname > enablehostname # configure terminalEnable email notifications:
hostname (config) # fenotify email enableSet the mail port used to send the email notifications:
hostname (config) # fenotify email mailhub port <port-number>Save the configuration.
hostname (config) # write memory
Go to CLI configuration mode:
hostname > enablehostname # configure terminalEnable email notifications:
hostname (config) # fenotify email enableSet the domain from which emails appear to come:
hostname (config) # fenotify email domain <email-domain>(Optional) To include the hostname in the return address for email notifications:
hostname (config) # fenotify email return host-name <host_name>Set the user name in the return address for email notifications (the default is
do-not-reply):hostname (config) # fenotify email return user-name <user_name>Select one of the XML, JavaScript Object Notation (JSON), or Text options for the default format of the notification:
Note
The json_legacy-concise, json_legacy-extended, and json_legacy-normal formats are deprecated.
To send notifications in XML Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify email default format xml-conciseTo send notifications in XML Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (XML Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify email default format xml-extendedTo send notifications in XML Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify email default format xml-normal
To send notifications in JSON Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify email default format json-conciseTo send notifications in JSON Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (JSON Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify email default format json-extendedTo send notifications in JSON Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify email default format json-normal
To send notifications in Text Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify email default format text-conciseTo send notifications in Text Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (Text Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify email default format text-extendedTo send notifications in Text Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify email default format text-normal
Specify how the notification is delivered by default:
To deliver the notification as an email attachment, enter:
hostname (config) # fenotify email default send-as attachmentTo deliver the notification in the email body (the default), enter:
hostname (config) # fenotify email default send-as in-line
Specify the default delivery schedule for email notifications:
Note
Trellix recommends using
per-eventnotifications.To receive information about all events detected in the past 24 hours, enter:
hostname (config) # fenotify email default delivery daily-digestTo receive a daily notification for each entity that was the source of the event, enter:
hostname (config) # fenotify email default delivery daily-per-sourceTo receive an hourly notification for each entity that was the source of the event, enter:
hostname (config) # fenotify email default delivery hourly-per-sourceTo receive a notification every minute for each entity that was the source of the event, enter:
hostname (config) # fenotify email default delivery per-1min-per-sourceTo receive a notification every 5 minutes for each entity that was the source of the event, enter:
hostname (config) # fenotify email default delivery per-5min-per-sourceTo receive information about each event, sent when the event is triggered, enter:
hostname (config) # fenotify email default delivery per-event
Save the configuration:
hostname (config) # write memory
Go to CLI configuration mode:
hostname > enablehostname # configure terminalEnable email notifications:
hostname (config) # fenotify email enableEnable authentication for event mail notifications:
hostname (config) # fenotify email mailhub auth enableSet the authentication method you want to use to send event mail notifications. Available methods include
PLAIN,LOGIN, orCRAM-MD5.hostname (config) # fenotify email mailhub auth auth-method PLAINSet the username required to authenticate sending event email notifications:
hostname (config) # fenotify email mailhub auth username <username>Set the password required to authenticate sending event email notifications:
hostname (config) # fenotify email mailhub auth password <password>
Go to CLI configuration mode:
hostname > enablehostname # configure terminalEnable email notifications:
hostname (config) # fenotify email enableEnable From: line override for event mail notifications:
hostname (config) # fenotify email mailhub preferences from-line-override enableSet the minimum SSL protocol version required to send event mail notifications through SMTP. The following versions are supported:
ssl3: SSLv3 or higher is required.tls1: TLSv1 or higher is required.tls1.1: TLSv1.1 or higher is required.tls1.2: TLSv1.2 or higher is required.
hostname (config) # fenotify email mailhub preferences ssl-min-version <ssl-min-version>(Optional) Set the TLS certificate authority file for event mail notifications going through SMTP. You can choose filenames under the
/etc/pki/tls/certs/directory.hostname (config) # fenotify email mailhub preferences tls-ca-file <tls-ca-file>The following example sets the TLS certificate authority file for event mail notifications to
ca-bundle.crt:hostname (config) # fenotify email mailhub preferences tls-ca-file <ca-bundle.crt>(Optional) Set the TLS certificate file for event email notifications going through SMTP. You can choose filenames under the
/etc/pki/tls/directory.hostname (config) # fenotify email mailhub preferences tls-cert-file <tls-cert-file>The following example sets the TLS certificate file for event mail notifications to
cert.pem:hostname (config) # fenotify email mailhub preferences tls-cert-file <cert.pem>